If your business collects names, phone numbers or email addresses through a website, a WhatsApp line or a sign-up sheet, data protection is no longer something you can put off. POTRAZ, Zimbabwe’s Data Protection Authority, began mandatory compliance inspections on 1 September 2026, and the regulator has said it will step up audits in the final quarter of the year. That is now.
What the law requires
The Cyber and Data Protection Act [Chapter 12:07] governs how organisations collect, store and use personal information. Under the regulations introduced through Statutory Instrument 155 of 2024, businesses that process personal data must:
- Hold a data controller licence from POTRAZ
- Appoint a Data Protection Officer (DPO) and notify POTRAZ of who that person is
- Protect the data they hold with appropriate security measures
- Be transparent with people about what is collected and why
The inspections were announced in Regulatory Notice 2 of 2026. They look at licensing, cybersecurity measures and how data is governed inside the organisation.
The stakes are real
POTRAZ has warned that serious breaches of the Act can carry criminal penalties, including prison terms of up to seven years for company executives. The regulator says it has already trained close to 1,200 Data Protection Officers, so it expects businesses to have no excuse for lacking one.
The rules apply widely. Schools, clinics, retailers, NGOs and small online shops all handle personal data, and all fall within scope.
Your website is where inspectors (and customers) will look first
For most businesses, the website is the most visible place personal data is collected. Here is a quick checklist to review today:
- Publish a clear privacy policy. Explain what data you collect, why, how long you keep it and who to contact with questions. Link it from every page footer.
- Use HTTPS everywhere. An SSL certificate encrypts information as it travels between your visitors and your site. If your address bar does not show a padlock, fix this first.
- Collect only what you need. Does your contact form really need a date of birth or ID number? Every extra field is extra risk.
- Add consent checkboxes. If you plan to send newsletters or promotions, ask for permission clearly and do not pre-tick the box.
- Secure your admin area. Use strong passwords, two-factor authentication and separate logins for each staff member. Remove access for people who have left.
- Keep software updated. Outdated WordPress plugins and themes are one of the most common ways websites are breached.
- Know where your data lives. Find out where your hosting provider stores your website and its backups, and how they protect it.
- Have a breach plan. Decide in advance who acts and who gets told if something goes wrong.
Don’t forget WhatsApp and email
Many Zimbabwean businesses collect more customer data through WhatsApp and email than through their websites. Customer lists, order histories and payment confirmations all count as personal data. Secure those accounts, limit who can access them, and avoid keeping sensitive records on personal phones.
Start now, not after the knock on the door
Compliance is easier to build in than to bolt on in a hurry. Getting your licence, appointing a DPO and tidying up your website now will cost far less than dealing with an inspection you are not ready for. It will also show customers that you take their information seriously.
We can help
all.tech can review your website’s security, set up SSL, write and publish a privacy policy page, clean up your forms and keep your site maintained and up to date. For the licensing and DPO side, speak to a qualified data protection practitioner or contact POTRAZ directly.
Want a website security check? Message us on WhatsApp or email info@alltech.co.zw.
This article is general information and not legal advice.
